University Business - July/August 2011 - (Page 86)

Thwarting ID Thieves what information security is and what PCI compliance really means to us as an institution of higher education.” Mike Belton, senior security engineer for CDW-G, says it’s all about finding a good balance between what an organization is already doing, and what the standard expects. “That’s where an organization like [Elgin], where they have a relatively strong information security initiative already in place, really shines through. They’ve got all the moving pieces, but sometimes you need someone to put the dance together,” he says. Go-To Tips for Avoiding ID Theft This is what experts say administrators, staff, and students should be reminded of in an effort to avoid identity theft and the risks it brings to an institution. • Always question why someone is asking for a social security number. • Understand where information is stored to mitigate attacks. • Store important documents under lock and key and shred paper documents containing sensitive financial information before trashing. • Train students to understand the power of their personal data. • Improve awareness of social networking security. EDUCATE THE COMMUNITY One of the easiest ways to protect against identity theft and fraud is to make sure everyone using the internet on campus knows cial networking last year. Despite 85 percent of social networking users age 18 to 24 utilizing privacy settings on these sites, experts say there are still huge security risks associated with social networking. Swartz says the main problem in the social networking realm is that there’s a certain amount of trust inherent when sharing information with a group of “friends” in an online community. “The danger is someone within that setting could pretend to be PROVIDE SUPPORT ‘You can do a great harm in the trust of the people that you deal with, alumni in particular, or friends of the university, if they simply don’t think they can entrust their information to you.’ —Larry Conrad, EDUCAUSE Higher Education Information Security Council the risks involved and basic ways to protect themselves. In Texas, this type of education is a state requirement. “Part of our effort in making the awareness training so relevant to them is it’s important to keep university information safe,” says Dickerson. “But we want them to be good internet citizens, as well.” Faculty, staff, and students at the University of Houston are required to take an online training course that helps them safely use social media and protect themselves against identity theft. The interactive course materials and subsequent quiz are developed by students, for students. “The feedback that we’ve gotten is ‘Wow, this is really cool, I didn’t know this,’ ” says Dickerson. “It’s been very well received.” LEARN SOCIAL NETWORKING RISKS According to the Javelin Identity Fraud Survey, 58 percent of U.S. adults used so86 | July/August 2011 somebody they may not be, but you think they are.” And it’s this trust relationship that isn’t easy to tackle or control. “A trust relationship is more difficult to identify in a systematic way,” says Abraham of Rapid7. Outsiders utilizing it is one way many organizations are saying they have had security issues, he adds. “If you and I are both friends on Twitter or Facebook and I were to send you a message to go to a website, there’s an implied trust,” says Abraham. “If an attacker were able to leverage that sort of trust relationship, they may be able to send you a message as me to ask you to go to a website and be able to gain access to your work station.” Identifying a scam may sound simple, but Abraham says the public as a whole doesn’t have a good understanding of the risks of social media, which is why educating a campus community is incredibly important. Occasionally, even when following best practices, security breaches happen. In the event of a breach, it’s important to provide support for those affected and the entire campus community. “Quite frankly, when any one of us becomes a victim of identity theft, it’s a very personal crime,” says Joe Reynolds, identity fraud product manager for Travelers Insurance. To help client schools support their communities in the event of an identity theft event, Travelers offers identity fraud insurance to recover lost wages, lost time off, attorneys’ fees, and any other costs associated with reconciling the fraud. The company also offers identity fraud resolution services that Reynolds describes as “a handholding consulting process that takes a lot of the guesswork out of getting the identity fraud event resolved.” When two student workers stole sensitive materials from Eastern Michigan University in March, the communications staff immediately notified the campus community and the media. A Data Security Breach Information portal was created online featuring updates, a question-and-answer page, and information about what students could do to monitor their information to determine if it had been compromised. “We wanted to make sure everybody was aware of this and knew it was happening so they could let us know if they believed they were a victim,” says Walter Kraft, VP of communications. KNOW THE COSTS Identity theft is a big business that can seriously hurt business. Sileo relays the story of marketing company Epsilon’s data breach universitybusiness.com http://www.universitybusiness.com

Table of Contents for the Digital Edition of University Business - July/August 2011

University Business - July/August 2011
Contents
Editor's Note
Ad Index
College Index
Behind the News
Sense of Place
Viewpoint
Financial Success
Money Matters
Community Colleges
Funding Capture
Models of Efficiency
Thwarting ID Thieves
Embezzlement Epidemic
What's New
End Note

University Business - July/August 2011